Bug 496870 - Emit JSOP_STARTXMLEXPR before potentially emitting any LC nodes in a list. r=Waldo
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -6755,16 +6755,20 @@ js_EmitTree(JSContext *cx, JSCodeGenerat
return JS_FALSE;
break;
}
case TOK_XMLNAME:
if (pn->pn_arity == PN_LIST) {
JS_ASSERT(pn->pn_count != 0);
for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
+ if (pn2->pn_type == TOK_LC &&
+ js_Emit1(cx, cg, JSOP_STARTXMLEXPR) < 0) {
+ return JS_FALSE;
+ }
if (!js_EmitTree(cx, cg, pn2))
return JS_FALSE;
if (pn2 != pn->pn_head && js_Emit1(cx, cg, JSOP_ADD) < 0)
return JS_FALSE;
}
} else {
JS_ASSERT(pn->pn_arity == PN_NULLARY);
ok = (pn->pn_op == JSOP_OBJECT)